devnomads-cli 0.3.0__py3-none-any.whl

dncli.py

@@ -0,0 +1,3608 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.10"
+# dependencies = [
+#     "typer>=0.12",
+#     "httpx>=0.27",
+#     "rich>=13",
+#     "cryptography>=42",
+#     "devnomads>=0.1",
+# ]
+# ///
+"""dncli - manage DevNomads services from the command line.
+
+Single-file CLI for the DevNomads public API (https://api.devnomads.nl).
+Create an API key in the control panel, run `dncli configure`, and go.
+See PLAN.md in the repository for the design.
+"""
+
+from __future__ import annotations
+
+import base64
+import configparser
+import hashlib
+import hmac
+import io
+import json
+import os
+import secrets
+import stat
+import sys
+import time
+import urllib.parse
+from contextlib import nullcontext
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+from typing import Annotated, Any, ContextManager, Iterable, Protocol
+
+import httpx
+import typer
+from devnomads.api import ApiError, AuthError
+from devnomads.api import Client as ApiClient
+from devnomads.api import DevNomadsError
+from devnomads.api.client import _unwrap as _lib_unwrap
+from devnomads.dns import Dns, challenge_name
+from rich.console import Console
+from rich.table import Table
+from typer.core import TyperGroup
+
+__version__ = "0.3.0"
+
+# ---------------------------------------------------------------------------
+# Constants
+
+DEFAULT_API_URL = "https://api.devnomads.nl"
+DEFAULT_PROFILE = "default"
+ENV_API_KEY = "DN_API_KEY"
+ENV_PROFILE = "DN_PROFILE"
+ENV_CONFIG_DIR = "DN_CONFIG_DIR"
+PROVIDERS = ("auroradns", "transip")
+REQUEST_TIMEOUT = 30.0
+RECORD_COLUMNS = ["name", "type", "ttl", "content", "disabled"]
+
+# Data on stdout, everything meant for humans on stderr.
+out_console = Console()
+err_console = Console(stderr=True)
+
+
+class CliError(typer.Exit):
+    """Fatal user-facing error: one line on stderr, exit code 1."""
+
+    def __init__(self, message: str) -> None:
+        # soft_wrap keeps the error a single grep-able line
+        err_console.print(f"[red]error:[/] {message}", soft_wrap=True)
+        self.message = message
+        super().__init__(code=1)
+
+
+# ---------------------------------------------------------------------------
+# Config layer
+
+
+def config_dir() -> Path:
+    if env_dir := os.environ.get(ENV_CONFIG_DIR):
+        return Path(env_dir)
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    base = Path(xdg) if xdg else Path.home() / ".config"
+    return base / "dnctl"
+
+
+def credentials_path() -> Path:
+    return config_dir() / "credentials"
+
+
+def load_credentials() -> configparser.ConfigParser:
+    parser = configparser.ConfigParser()
+    path = credentials_path()
+    if path.exists():
+        mode = stat.S_IMODE(path.stat().st_mode)
+        if mode & 0o077:
+            err_console.print(
+                f"[yellow]warning:[/] {path} is readable by others "
+                f"(mode {mode:03o}); run: chmod 600 {path}"
+            )
+        parser.read(path)
+    return parser
+
+
+def _write_private(path: Path, content: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.parent.chmod(0o700)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as fh:
+        fh.write(content)
+    path.chmod(0o600)
+
+
+def save_credentials(parser: configparser.ConfigParser) -> None:
+    buffer = io.StringIO()
+    parser.write(buffer)
+    _write_private(credentials_path(), buffer.getvalue())
+
+
+def devnomads_profiles(parser: configparser.ConfigParser) -> list[str]:
+    # Plain sections are DevNomads accounts; "provider:name" sections
+    # belong to transfer source drivers.
+    return [section for section in parser.sections() if ":" not in section]
+
+
+def resolve_credentials(state: AppState) -> tuple[str, str]:
+    """Resolve (api_key, api_url): flag > env > profile > [default]."""
+
+    parser = load_credentials()
+    profile = state.profile or os.environ.get(ENV_PROFILE) or DEFAULT_PROFILE
+    explicit = bool(state.profile or os.environ.get(ENV_PROFILE))
+    section = parser[profile] if parser.has_section(profile) else None
+    api_url = section.get("api_url", DEFAULT_API_URL) if section else DEFAULT_API_URL
+    api_key = (
+        state.api_key
+        or os.environ.get(ENV_API_KEY)
+        or (section.get("api_key") if section else None)
+    )
+    if not api_key:
+        if explicit and section is None:
+            available = ", ".join(devnomads_profiles(parser)) or "none"
+            raise CliError(
+                f"profile '{profile}' not found in {credentials_path()} "
+                f"(available: {available})"
+            )
+        raise CliError(f"no API key found; run `dncli configure` or set {ENV_API_KEY}")
+    return api_key, api_url
+
+
+# ---------------------------------------------------------------------------
+# Output
+
+
+class OutputFormat(str, Enum):
+    table = "table"
+    json = "json"
+
+
+@dataclass
+class AppState:
+    profile: str | None = None
+    api_key: str | None = None
+    output: OutputFormat | None = None
+    debug: bool = False
+    client: DevNomadsClient | None = None
+
+
+def state_from(ctx: typer.Context, output: OutputFormat | None = None) -> AppState:
+    state = ctx.obj
+    if not isinstance(state, AppState):  # direct invocation in tests
+        state = AppState()
+        ctx.obj = state
+    if output is not None:  # per-command --output overrides the global one
+        state.output = output
+    return state
+
+
+def resolve_format(state: AppState) -> OutputFormat:
+    if state.output:
+        return state.output
+    return OutputFormat.table if sys.stdout.isatty() else OutputFormat.json
+
+
+def render(
+    state: AppState,
+    data: Any,
+    *,
+    columns: list[str] | None = None,
+    title: str | None = None,
+) -> None:
+    """Render data on stdout: JSON for machines, a rich table for humans."""
+
+    if resolve_format(state) is OutputFormat.json:
+        sys.stdout.write(json.dumps(data, indent=2, default=str) + "\n")
+        return
+    if isinstance(data, dict):
+        _render_kv(data, title)
+    elif isinstance(data, list):
+        _render_rows(data, columns, title)
+    else:
+        out_console.print(str(data), soft_wrap=True)
+
+
+def _cell(value: Any) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, bool):
+        return "yes" if value else "no"
+    if isinstance(value, list) and not any(
+        isinstance(item, (dict, list)) for item in value
+    ):
+        return ", ".join(str(item) for item in value)
+    if isinstance(value, (dict, list)):
+        return json.dumps(value)
+    return str(value)
+
+
+def _flatten_row(row: dict[str, Any]) -> dict[str, Any]:
+    """Merge one level of nested objects into the row, so type-specific
+    details (e.g. the "proxy" object on proxy services) become real
+    columns. On a name collision the nested key gets a parent_ prefix."""
+
+    flat: dict[str, Any] = {}
+    nested: list[tuple[str, dict[str, Any]]] = []
+    for key, value in row.items():
+        if isinstance(value, dict):
+            nested.append((key, value))
+        else:
+            flat[key] = value
+    for parent, obj in nested:
+        for key, value in obj.items():
+            column = key if key not in flat else f"{parent}_{key}"
+            flat[column] = value
+    return flat
+
+
+def _render_kv(data: dict[str, Any], title: str | None) -> None:
+    table = Table(title=title, show_header=False)
+    table.add_column(style="bold")
+    table.add_column()
+    for key, value in _flatten_row(data).items():
+        table.add_row(key, _cell(value))
+    out_console.print(table)
+
+
+def _render_rows(
+    rows: list[dict[str, Any]], columns: list[str] | None, title: str | None
+) -> None:
+    if not rows:
+        err_console.print("[dim]no results[/]")
+        return
+    rows = [_flatten_row(row) if isinstance(row, dict) else row for row in rows]
+    cols = columns or list(rows[0].keys())
+    table = Table(title=title)
+    for col in cols:
+        table.add_column(col)
+    for row in rows:
+        table.add_row(*(_cell(row.get(col)) for col in cols))
+    out_console.print(table)
+
+
+def sort_rows(rows: list[dict[str, Any]], sort: str | None) -> list[dict[str, Any]]:
+    """Sort rows by a field; a leading '-' reverses. None sorts last."""
+
+    if not sort or not rows:
+        return rows
+    reverse = sort.startswith("-")
+    field = sort.lstrip("-")
+    if not any(field in row for row in rows):
+        available = ", ".join(rows[0].keys())
+        raise CliError(f"unknown sort field '{field}' (available: {available})")
+    values = [row.get(field) for row in rows]
+    numeric = all(
+        isinstance(value, (int, float)) and not isinstance(value, bool)
+        for value in values
+        if value is not None
+    )
+
+    def key(row: dict[str, Any]) -> tuple[int, Any]:
+        value = row.get(field)
+        if value is None:
+            return (1, 0 if numeric else "")
+        return (0, value if numeric else str(value).lower())
+
+    return sorted(rows, key=key, reverse=reverse)
+
+
+def _confirm(question: str, yes: bool) -> None:
+    if yes:
+        return
+    if not sys.stdin.isatty():
+        raise CliError("confirmation required; pass --yes to confirm non-interactively")
+    if not typer.confirm(question, err=True):
+        raise typer.Abort()
+
+
+def _mask(secret: str) -> str:
+    if not secret:
+        return ""
+    if len(secret) <= 8:
+        return "****"
+    return f"{secret[:4]}...{secret[-4:]}"
+
+
+def working(message: str) -> ContextManager[Any]:
+    """Spinner on stderr while a request is in flight. Inert when stderr
+    is not a terminal (pipelines, CI, redirects), so output stays clean.
+    Never nest two of these: rich allows one live display at a time."""
+
+    if err_console.is_terminal:
+        return err_console.status(message, spinner="dots")
+    return nullcontext()
+
+
+# ---------------------------------------------------------------------------
+# API client
+
+
+class DevNomadsClient:
+    """Thin wrapper over the shared :class:`devnomads.api.Client`.
+
+    The library owns auth, retries, the Laravel envelope, and the HTTP
+    transport; this wrapper keeps dncli's UX: the Rich spinner while a
+    request is in flight, and library errors re-raised as :class:`CliError`
+    with dncli's own message wording. Commands never touch httpx directly.
+    """
+
+    def __init__(self, api_url: str, api_key: str, *, debug: bool = False) -> None:
+        self.debug = debug
+        self._client = ApiClient(
+            api_url,
+            api_key,
+            user_agent=f"dncli/{__version__}",
+            timeout=REQUEST_TIMEOUT,
+        )
+
+    @property
+    def api(self) -> ApiClient:
+        """The underlying shared transport, for the dns/acme helpers."""
+
+        return self._client
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: dict[str, Any] | None = None,
+        json_body: Any = None,
+    ) -> Any:
+        if self.debug:
+            suffix = f" {json.dumps(json_body)}" if json_body is not None else ""
+            err_console.print(f"[dim]> {method} {path}{suffix}[/]")
+        with working(f"{method} {path}"):
+            try:
+                return self._client.request(
+                    method, path, params=params, json_body=json_body
+                )
+            except (AuthError, ApiError) as exc:
+                raise CliError(_error_message(exc.status, exc.detail)) from exc
+            except DevNomadsError as exc:
+                raise CliError(str(exc)) from exc
+
+
+def _unwrap(body: Any) -> Any:
+    """Strip the Laravel API resource envelope ({"data": ...}, optionally
+    with links/meta). The transport already unwraps responses; this thin
+    re-export keeps the helper available to callers and tests."""
+
+    return _lib_unwrap(body)
+
+
+def _error_message(status: int, detail: str) -> str:
+    message = f"API error {status}"
+    if detail:
+        message += f": {detail}"
+    if status == 401:
+        message += " - check your API key (run `dncli configure`)"
+    return message
+
+
+def get_client(state: AppState) -> DevNomadsClient:
+    if state.client is None:
+        api_key, api_url = resolve_credentials(state)
+        state.client = DevNomadsClient(api_url, api_key, debug=state.debug)
+    return state.client
+
+
+# ---------------------------------------------------------------------------
+# DNS record helpers (PowerDNS rrsets)
+
+
+def zone_id(zone: str) -> str:
+    """PowerDNS zone ids carry a trailing dot; accept names without it."""
+
+    return zone if zone.endswith(".") else f"{zone}."
+
+
+def fqdn(name: str, zone: str) -> str:
+    """Absolute record name with trailing dot, PowerDNS style."""
+
+    zone_root = zone.rstrip(".")
+    relative = name.rstrip(".")
+    if relative in ("@", ""):
+        return f"{zone_root}."
+    if relative == zone_root or relative.endswith(f".{zone_root}"):
+        return f"{relative}."
+    return f"{relative}.{zone_root}."
+
+
+def flatten_rrsets(rrsets: Iterable[dict[str, Any]]) -> list[dict[str, Any]]:
+    """One row per record value, for display and `records list`."""
+
+    rows = []
+    for rrset in rrsets or []:
+        for record in rrset.get("records", []):
+            rows.append(
+                {
+                    "name": rrset.get("name"),
+                    "type": rrset.get("type"),
+                    "ttl": rrset.get("ttl"),
+                    "content": record.get("content"),
+                    "disabled": record.get("disabled", False),
+                }
+            )
+    return sorted(rows, key=lambda row: (row["name"] or "", row["type"] or ""))
+
+
+def build_rrset(
+    zone: str,
+    name: str,
+    rtype: str,
+    *,
+    changetype: str,
+    ttl: int | None = None,
+    contents: Iterable[str] = (),
+) -> dict[str, Any]:
+    rrset: dict[str, Any] = {
+        "name": fqdn(name, zone),
+        "type": rtype.upper(),
+        "changetype": changetype,
+    }
+    if changetype == "REPLACE":
+        rrset["ttl"] = ttl
+        rrset["records"] = [
+            {"content": content, "disabled": False} for content in contents
+        ]
+    return rrset
+
+
+# ---------------------------------------------------------------------------
+# DNS transfer: pull a zone from another provider into DevNomads.
+# Drivers are read-only by design; writing happens exclusively on the
+# DevNomads side through the PowerDNS rrsets PATCH.
+
+
+@dataclass(frozen=True)
+class TransferRecord:
+    """Provider-neutral record: relative name ("@" for the apex), TTL in
+    seconds, and content in PowerDNS style (MX/SRV priority embedded)."""
+
+    name: str
+    type: str
+    content: str
+    ttl: int
+
+
+class DnsSource(Protocol):
+    name: str
+
+    def get_records(self, zone: str) -> list[TransferRecord]: ...
+
+
+HOST_CONTENT_TYPES = {"CNAME", "NS", "PTR", "ALIAS", "MX", "SRV"}
+
+
+def normalize_content(rtype: str, content: str) -> str:
+    """Canonicalize record content the PowerDNS way, so source and target
+    records compare equal: hostname targets get a trailing dot, TXT values
+    get quoted. Idempotent on already-canonical content."""
+
+    content = content.strip()
+    if rtype == "TXT":
+        return content if content.startswith('"') else f'"{content}"'
+    if rtype in HOST_CONTENT_TYPES:
+        parts = content.split()
+        if parts and not parts[-1].endswith("."):
+            parts[-1] += "."
+        return " ".join(parts)
+    return content
+
+
+def _transfer_skip(name: str, rtype: str, zone: str) -> bool:
+    # the target zone owns its SOA and apex NS records
+    if rtype == "SOA":
+        return True
+    return rtype == "NS" and name == f"{zone.rstrip('.')}."
+
+
+def desired_rrsets(
+    records: Iterable[TransferRecord], zone: str
+) -> dict[tuple[str, str], dict[str, Any]]:
+    """Group normalized source records into PowerDNS-comparable rrsets."""
+
+    out: dict[tuple[str, str], dict[str, Any]] = {}
+    for record in records:
+        rtype = record.type.upper()
+        name = fqdn(record.name, zone)
+        if _transfer_skip(name, rtype, zone):
+            continue
+        entry = out.setdefault((name, rtype), {"ttl": record.ttl, "contents": set()})
+        entry["ttl"] = min(entry["ttl"], record.ttl)
+        entry["contents"].add(normalize_content(rtype, record.content))
+    return out
+
+
+def current_rrsets(
+    rrsets: Iterable[dict[str, Any]], zone: str
+) -> dict[tuple[str, str], dict[str, Any]]:
+    """The same comparable shape, from a DevNomads (PowerDNS) zone."""
+
+    out: dict[tuple[str, str], dict[str, Any]] = {}
+    for rrset in rrsets or []:
+        rtype = str(rrset.get("type", "")).upper()
+        name = str(rrset.get("name", ""))
+        if _transfer_skip(name, rtype, zone):
+            continue
+        out[(name, rtype)] = {
+            "ttl": rrset.get("ttl"),
+            "contents": {
+                normalize_content(rtype, record["content"])
+                for record in rrset.get("records", [])
+            },
+        }
+    return out
+
+
+def diff_rrsets(
+    current: dict[tuple[str, str], dict[str, Any]],
+    desired: dict[tuple[str, str], dict[str, Any]],
+) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
+    """Compute (display rows, PATCH rrsets) to turn current into desired."""
+
+    changes: list[dict[str, Any]] = []
+    patch: list[dict[str, Any]] = []
+    for key in sorted(set(current) | set(desired)):
+        old, new = current.get(key), desired.get(key)
+        if old == new:
+            continue
+        name, rtype = key
+        if new is None:
+            if old is None:
+                continue
+            changes.append(
+                {
+                    "action": "delete",
+                    "name": name,
+                    "type": rtype,
+                    "ttl": old["ttl"],
+                    "content": "; ".join(sorted(old["contents"])),
+                }
+            )
+            patch.append({"name": name, "type": rtype, "changetype": "DELETE"})
+            continue
+        changes.append(
+            {
+                "action": "create" if old is None else "update",
+                "name": name,
+                "type": rtype,
+                "ttl": new["ttl"],
+                "content": "; ".join(sorted(new["contents"])),
+            }
+        )
+        patch.append(
+            {
+                "name": name,
+                "type": rtype,
+                "ttl": new["ttl"],
+                "changetype": "REPLACE",
+                "records": [
+                    {"content": content, "disabled": False}
+                    for content in sorted(new["contents"])
+                ],
+            }
+        )
+    return changes, patch
+
+
+class TransipSource:
+    """TransIP REST API v6: RSA-SHA512 signed auth request for a read-only
+    JWT, then plain bearer requests."""
+
+    name = "transip"
+
+    def __init__(
+        self, login: str, private_key_pem: str, api_url: str | None = None
+    ) -> None:
+        self.login = login
+        self.private_key_pem = private_key_pem
+        self._http = httpx.Client(
+            base_url=api_url or "https://api.transip.nl/v6",
+            headers={"User-Agent": f"dncli/{__version__}"},
+            timeout=REQUEST_TIMEOUT,
+        )
+        self._authenticated = False
+
+    def _authenticate(self) -> None:
+        from cryptography.hazmat.primitives import hashes, serialization
+        from cryptography.hazmat.primitives.asymmetric import padding, rsa
+
+        try:
+            key = serialization.load_pem_private_key(
+                self.private_key_pem.encode(), password=None
+            )
+        except ValueError as exc:
+            raise CliError(f"cannot load TransIP private key: {exc}") from exc
+        if not isinstance(key, rsa.RSAPrivateKey):
+            raise CliError("the TransIP private key must be an RSA key")
+        nonce = secrets.token_hex(16)
+        body = json.dumps(
+            {
+                "login": self.login,
+                "nonce": nonce,
+                "read_only": True,
+                "expiration_time": "30 minutes",
+                "label": f"dncli-{nonce[:10]}",
+                "global_key": True,
+            }
+        )
+        signature = base64.b64encode(
+            key.sign(body.encode(), padding.PKCS1v15(), hashes.SHA512())
+        ).decode()
+        with working("authenticating with TransIP"):
+            response = self._http.post(
+                "/auth",
+                content=body,
+                headers={"Signature": signature, "Content-Type": "application/json"},
+            )
+        if response.status_code >= 400:
+            raise CliError(
+                f"TransIP authentication failed ({response.status_code}): "
+                f"{_provider_error(response)} - check the login name and private "
+                "key, and that non-whitelisted API keys are allowed in the "
+                "TransIP control panel"
+            )
+        self._http.headers["Authorization"] = f"Bearer {response.json()['token']}"
+        self._authenticated = True
+
+    def get_records(self, zone: str) -> list[TransferRecord]:
+        if not self._authenticated:
+            self._authenticate()
+        with working(f"TransIP: GET /domains/{zone}/dns"):
+            response = self._http.get(f"/domains/{zone}/dns")
+        if response.status_code >= 400:
+            raise CliError(
+                f"TransIP returned {response.status_code} for zone '{zone}': "
+                f"{_provider_error(response)}"
+            )
+        return [
+            TransferRecord(
+                name=str(entry["name"]),
+                type=str(entry["type"]).upper(),
+                content=str(entry["content"]),
+                ttl=int(entry["expire"]),
+            )
+            for entry in response.json().get("dnsEntries", [])
+        ]
+
+
+class AuroraDnsSource:
+    """AuroraDNS (PCextreme): HMAC-SHA256 signed requests, protocol as
+    implemented in Apache Libcloud's auroradns driver."""
+
+    name = "auroradns"
+
+    def __init__(
+        self, api_key: str, secret_key: str, api_url: str | None = None
+    ) -> None:
+        self.api_key = api_key
+        self.secret_key = secret_key
+        self._http = httpx.Client(
+            base_url=api_url or "https://api.auroradns.eu",
+            headers={"User-Agent": f"dncli/{__version__}"},
+            timeout=REQUEST_TIMEOUT,
+        )
+
+    def _headers(self, method: str, path: str) -> dict[str, str]:
+        timestamp = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime())
+        signature = base64.b64encode(
+            hmac.new(
+                self.secret_key.encode(),
+                f"{method}{path}{timestamp}".encode(),
+                hashlib.sha256,
+            ).digest()
+        ).decode()
+        token = base64.b64encode(f"{self.api_key}:{signature}".encode()).decode()
+        return {
+            "X-AuroraDNS-Date": timestamp,
+            "Authorization": f"AuroraDNSv1 {token}",
+        }
+
+    def _get(self, path: str) -> Any:
+        with working(f"AuroraDNS: GET {path}"):
+            response = self._http.get(path, headers=self._headers("GET", path))
+        if response.status_code >= 400:
+            raise CliError(
+                f"AuroraDNS returned {response.status_code} for {path}: "
+                f"{_provider_error(response)}"
+            )
+        return response.json()
+
+    def get_records(self, zone: str) -> list[TransferRecord]:
+        zones = self._get("/zones")
+        zone_id = next(
+            (
+                item["id"]
+                for item in zones
+                if str(item.get("name", "")).rstrip(".") == zone.rstrip(".")
+            ),
+            None,
+        )
+        if zone_id is None:
+            raise CliError(f"zone '{zone}' not found in this AuroraDNS account")
+        records = []
+        for record in self._get(f"/zones/{zone_id}/records"):
+            rtype = str(record["type"]).upper()
+            content = str(record["content"])
+            prio = record.get("prio")
+            if rtype in ("MX", "SRV") and prio is not None:
+                content = f"{prio} {content}"
+            records.append(
+                TransferRecord(
+                    name=str(record.get("name") or "@"),
+                    type=rtype,
+                    content=content,
+                    ttl=int(record["ttl"]),
+                )
+            )
+        return records
+
+
+def _provider_error(response: httpx.Response) -> str:
+    try:
+        body = response.json()
+    except ValueError:
+        return response.text[:200]
+    if isinstance(body, dict):
+        return str(body.get("error") or body.get("errormsg") or body)
+    return str(body)
+
+
+def _source_value(
+    stored: dict[str, str], key: str, env_var: str, label: str, *, hide: bool = False
+) -> str:
+    value = stored.get(key) or os.environ.get(env_var)
+    if value:
+        return value
+    if not sys.stdin.isatty():
+        raise CliError(
+            f"missing source credential '{label}'; store it with "
+            f"`dncli configure --provider <driver>` or set {env_var}"
+        )
+    return typer.prompt(label, hide_input=hide, err=True)
+
+
+def build_source(driver: str, source_profile: str | None) -> DnsSource:
+    if driver not in PROVIDERS:
+        raise CliError(f"unknown driver '{driver}' (available: {', '.join(PROVIDERS)})")
+    parser = load_credentials()
+    section = f"{driver}:{source_profile or DEFAULT_PROFILE}"
+    stored = dict(parser[section]) if parser.has_section(section) else {}
+    if source_profile and not stored:
+        raise CliError(
+            f"profile '{section}' not found; run: "
+            f"dncli configure --provider {driver} --profile {source_profile}"
+        )
+    api_url = stored.get("api_url")  # testing escape hatch, like the main client
+    if driver == "transip":
+        login = _source_value(stored, "login", "DN_TRANSIP_LOGIN", "TransIP login name")
+        key_file = _source_value(
+            stored,
+            "private_key_file",
+            "DN_TRANSIP_PRIVATE_KEY_FILE",
+            "Path to TransIP private key (PEM)",
+        )
+        try:
+            pem = Path(key_file).expanduser().read_text()
+        except OSError as exc:
+            raise CliError(f"cannot read TransIP private key: {exc}") from exc
+        return TransipSource(login, pem, api_url)
+    api_key = _source_value(
+        stored, "api_key", "DN_AURORADNS_API_KEY", "AuroraDNS API key", hide=True
+    )
+    secret_key = _source_value(
+        stored,
+        "secret_key",
+        "DN_AURORADNS_SECRET_KEY",
+        "AuroraDNS secret key",
+        hide=True,
+    )
+    return AuroraDnsSource(api_key, secret_key, api_url)
+
+
+# ---------------------------------------------------------------------------
+# CLI
+
+
+class PrefixGroup(TyperGroup):
+    """Resolve unique command prefixes: `dncli e l` runs `dncli emails list`.
+
+    Exact names always win; an ambiguous prefix fails listing the matches."""
+
+    # typer vendors click, so the context/command annotations stay loose
+    def get_command(self, ctx: Any, cmd_name: str) -> Any:
+        command = super().get_command(ctx, cmd_name)
+        if command is not None:
+            return command
+        matches = [
+            name for name in self.list_commands(ctx) if name.startswith(cmd_name)
+        ]
+        if len(matches) == 1:
+            return super().get_command(ctx, matches[0])
+        if matches:
+            ctx.fail(f"'{cmd_name}' is ambiguous: {', '.join(sorted(matches))}")
+        return None
+
+    def resolve_command(self, ctx: Any, args: Any) -> Any:
+        # report the resolved full command name, not the typed prefix
+        _, command, remaining = super().resolve_command(ctx, args)
+        return command.name if command else None, command, remaining
+
+
+app = typer.Typer(
+    name="dncli",
+    cls=PrefixGroup,
+    help="Manage your DevNomads services from the command line.",
+    no_args_is_help=True,
+)
+configure_app = typer.Typer(cls=PrefixGroup, help="Manage stored credential profiles.")
+services_app = typer.Typer(
+    cls=PrefixGroup, help="Your DevNomads services.", no_args_is_help=True
+)
+dns_app = typer.Typer(
+    cls=PrefixGroup, help="DNS zones and records.", no_args_is_help=True
+)
+zones_app = typer.Typer(cls=PrefixGroup, help="DNS zones.", no_args_is_help=True)
+records_app = typer.Typer(cls=PrefixGroup, help="DNS records.", no_args_is_help=True)
+
+app.add_typer(configure_app, name="configure")
+app.add_typer(services_app, name="services")
+app.add_typer(dns_app, name="dns")
+dns_app.add_typer(zones_app, name="zones")
+dns_app.add_typer(records_app, name="records")
+
+
+SortOption = Annotated[
+    str | None,
+    typer.Option(
+        "--sort",
+        help="Sort by field; prefix with - for descending (e.g. --sort -ttl).",
+    ),
+]
+OutputOption = Annotated[
+    OutputFormat | None,
+    typer.Option("--output", "-o", help="Output format (table or json)."),
+]
+
+
+def _version_callback(value: bool) -> None:
+    if value:
+        sys.stdout.write(f"dncli {__version__}\n")
+        raise typer.Exit()
+
+
+@app.callback()
+def main(
+    ctx: typer.Context,
+    profile: Annotated[
+        str | None,
+        typer.Option(
+            "--profile", "-p", help=f"Credentials profile (env: {ENV_PROFILE})."
+        ),
+    ] = None,
+    api_key: Annotated[
+        str | None,
+        typer.Option(
+            "--api-key", help=f"API key, beats any profile (env: {ENV_API_KEY})."
+        ),
+    ] = None,
+    output: Annotated[
+        OutputFormat | None,
+        typer.Option(
+            "--output",
+            "-o",
+            help="Output format; default: table on a TTY, json when piped.",
+        ),
+    ] = None,
+    debug: Annotated[
+        bool, typer.Option("--debug", help="Log the HTTP exchange to stderr.")
+    ] = False,
+    version: Annotated[
+        bool,
+        typer.Option(
+            "--version",
+            callback=_version_callback,
+            is_eager=True,
+            help="Print version and exit.",
+        ),
+    ] = False,
+) -> None:
+    ctx.obj = AppState(profile=profile, api_key=api_key, output=output, debug=debug)
+
+
+# --- configure -------------------------------------------------------------
+
+
+@configure_app.callback(invoke_without_command=True)
+def configure(
+    ctx: typer.Context,
+    profile: Annotated[
+        str, typer.Option(help="Profile name to create or update.")
+    ] = DEFAULT_PROFILE,
+    provider: Annotated[
+        str | None,
+        typer.Option(
+            help="Configure a DNS transfer source profile "
+            f"({', '.join(PROVIDERS)}) instead of a DevNomads profile."
+        ),
+    ] = None,
+) -> None:
+    """Interactively store credentials in your home directory."""
+
+    if ctx.invoked_subcommand:
+        return
+    if provider is None:
+        section = profile
+        values = {
+            "api_key": typer.prompt("DevNomads API key", hide_input=True, err=True)
+        }
+    elif provider == "auroradns":
+        section = f"auroradns:{profile}"
+        values = {
+            "api_key": typer.prompt("AuroraDNS API key", hide_input=True, err=True),
+            "secret_key": typer.prompt(
+                "AuroraDNS secret key", hide_input=True, err=True
+            ),
+        }
+    elif provider == "transip":
+        section = f"transip:{profile}"
+        login = typer.prompt("TransIP login name", err=True)
+        key_source = typer.prompt("Path to TransIP private key (PEM)", err=True)
+        key_path = _import_private_key(Path(key_source).expanduser(), profile)
+        values = {"login": login, "private_key_file": str(key_path)}
+    else:
+        raise CliError(
+            f"unknown provider '{provider}' (available: {', '.join(PROVIDERS)})"
+        )
+    parser = load_credentials()
+    if not parser.has_section(section):
+        parser.add_section(section)
+    for key, value in values.items():
+        parser.set(section, key, value)
+    save_credentials(parser)
+    err_console.print(f"profile '{section}' written to {credentials_path()}")
+
+
+def _import_private_key(source: Path, profile: str) -> Path:
+    try:
+        pem = source.read_text()
+    except OSError as exc:
+        raise CliError(f"cannot read private key: {exc}") from exc
+    if "PRIVATE KEY" not in pem:
+        raise CliError(f"{source} does not look like a PEM private key")
+    target = config_dir() / f"transip-{profile}.pem"
+    _write_private(target, pem)
+    return target
+
+
+@configure_app.command("list")
+def configure_list(
+    ctx: typer.Context, sort: SortOption = None, output: OutputOption = None
+) -> None:
+    """List stored profiles (secrets masked)."""
+
+    parser = load_credentials()
+    rows = []
+    for section in parser.sections():
+        provider, _, name = section.partition(":")
+        values = parser[section]
+        secret = values.get("api_key") or values.get("secret_key") or ""
+        rows.append(
+            {
+                "profile": section,
+                "type": provider if name else "devnomads",
+                "api_key": _mask(secret) or values.get("login", ""),
+            }
+        )
+    render(
+        state_from(ctx, output),
+        sort_rows(rows, sort),
+        columns=["profile", "type", "api_key"],
+        title="Profiles",
+    )
+
+
+# --- services ----------------------------------------------------------------
+
+
+@services_app.command("list")
+def services_list(
+    ctx: typer.Context, sort: SortOption = None, output: OutputOption = None
+) -> None:
+    """List all your services."""
+
+    state = state_from(ctx, output)
+    data = get_client(state).request("GET", "/services")
+    if isinstance(data, list):
+        data = sort_rows(data, sort)
+    render(
+        state,
+        data,
+        columns=["service_id", "type", "entity", "started_at", "ended_at"],
+        title="Services",
+    )
+
+
+@services_app.command("show")
+def services_show(
+    ctx: typer.Context,
+    service_id: Annotated[int, typer.Argument(help="Service ID.")],
+    output: OutputOption = None,
+) -> None:
+    """Show one service."""
+
+    state = state_from(ctx, output)
+    data = get_client(state).request("GET", f"/services/{service_id}")
+    render(state, data, title=f"Service {service_id}")
+
+
+# --- dns zones ---------------------------------------------------------------
+
+
+@zones_app.command("list")
+def zones_list(
+    ctx: typer.Context, sort: SortOption = None, output: OutputOption = None
+) -> None:
+    """List your DNS zones."""
+
+    state = state_from(ctx, output)
+    data = get_client(state).request("GET", "/services/dns/zones")
+    if isinstance(data, list):
+        data = sort_rows(data, sort)
+    render(
+        state,
+        data,
+        columns=["name", "kind", "serial", "dnssec"],
+        title="DNS zones",
+    )
+
+
+@zones_app.command("show")
+def zones_show(
+    ctx: typer.Context,
+    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    output: OutputOption = None,
+) -> None:
+    """Show a DNS zone including its records."""
+
+    state = state_from(ctx, output)
+    data = get_client(state).request("GET", f"/services/dns/zones/{zone_id(zone)}")
+    if resolve_format(state) is OutputFormat.json or not isinstance(data, dict):
+        render(state, data)
+        return
+    meta = {key: value for key, value in data.items() if key != "rrsets"}
+    render(state, meta, title=zone)
+    render(
+        state,
+        flatten_rrsets(data.get("rrsets", [])),
+        columns=RECORD_COLUMNS,
+        title="Records",
+    )
+
+
+# --- dns records -------------------------------------------------------------
+
+
+@records_app.command("list")
+def records_list(
+    ctx: typer.Context,
+    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    sort: SortOption = None,
+    output: OutputOption = None,
+) -> None:
+    """List the records in a zone, one row per value."""
+
+    state = state_from(ctx, output)
+    data = get_client(state).request("GET", f"/services/dns/zones/{zone_id(zone)}")
+    rrsets = data.get("rrsets", []) if isinstance(data, dict) else []
+    render(
+        state,
+        sort_rows(flatten_rrsets(rrsets), sort),
+        columns=RECORD_COLUMNS,
+        title=f"Records in {zone}",
+    )
+
+
+@records_app.command("set")
+def records_set(
+    ctx: typer.Context,
+    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    name: Annotated[
+        str, typer.Argument(help="Record name relative to the zone; @ for the apex.")
+    ],
+    rtype: Annotated[
+        str, typer.Argument(metavar="TYPE", help="Record type, e.g. A, MX, TXT.")
+    ],
+    content: Annotated[
+        list[str],
+        typer.Argument(
+            help="One or more record values; replaces the whole record set."
+        ),
+    ],
+    ttl: Annotated[int, typer.Option(help="TTL in seconds.")] = 3600,
+) -> None:
+    """Create or replace a record set (PowerDNS REPLACE semantics)."""
+
+    state = state_from(ctx)
+    rrset = build_rrset(
+        zone, name, rtype, changetype="REPLACE", ttl=ttl, contents=content
+    )
+    payload = {"rrsets": [rrset]}
+    get_client(state).request(
+        "PATCH", f"/services/dns/zones/{zone_id(zone)}", json_body=payload
+    )
+    err_console.print(
+        f"set {rrset['name']} {rrset['type']} "
+        f"({len(rrset['records'])} value(s), ttl {ttl})"
+    )
+
+
+@records_app.command("delete")
+def records_delete(
+    ctx: typer.Context,
+    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    name: Annotated[
+        str, typer.Argument(help="Record name relative to the zone; @ for the apex.")
+    ],
+    rtype: Annotated[
+        str, typer.Argument(metavar="TYPE", help="Record type, e.g. A, MX, TXT.")
+    ],
+    yes: Annotated[
+        bool, typer.Option("--yes", "-y", help="Do not ask for confirmation.")
+    ] = False,
+) -> None:
+    """Delete a whole record set (all values for name + type)."""
+
+    state = state_from(ctx)
+    rrset = build_rrset(zone, name, rtype, changetype="DELETE")
+    _confirm(f"Delete all {rrset['type']} records for {rrset['name']}?", yes)
+    payload = {"rrsets": [rrset]}
+    get_client(state).request(
+        "PATCH", f"/services/dns/zones/{zone_id(zone)}", json_body=payload
+    )
+    err_console.print(f"deleted {rrset['name']} {rrset['type']}")
+
+
+@dns_app.command("transfer")
+def dns_transfer(
+    ctx: typer.Context,
+    from_: Annotated[
+        str,
+        typer.Option(
+            "--from",
+            metavar="DRIVER",
+            help=f"Source provider ({', '.join(PROVIDERS)}).",
+        ),
+    ],
+    zone: Annotated[
+        str, typer.Option("--zone", help="Zone name on both sides, e.g. example.com.")
+    ],
+    source_profile: Annotated[
+        str | None,
+        typer.Option(
+            "--source-profile",
+            help="Stored provider profile to read credentials from "
+            "(default: the provider's 'default' profile).",
+        ),
+    ] = None,
+    dry_run: Annotated[
+        bool, typer.Option("--dry-run", help="Show the changes without applying them.")
+    ] = False,
+    yes: Annotated[
+        bool, typer.Option("--yes", "-y", help="Do not ask for confirmation.")
+    ] = False,
+    output: OutputOption = None,
+) -> None:
+    """Copy a DNS zone from another provider into DevNomads.
+
+    Fetches the records at the source (read-only), diffs them against the
+    DevNomads zone, shows the changes, and applies them after confirmation.
+    SOA and apex NS records stay untouched - the platform owns those.
+    """
+
+    state = state_from(ctx, output)
+    client = get_client(state)  # resolve DevNomads credentials first: fail fast
+    source = build_source(from_, source_profile)
+    zones = client.request("GET", "/services/dns/zones")
+    known = {str(item.get("name", "")).rstrip(".") for item in zones or []}
+    if zone.rstrip(".") not in known:
+        raise CliError(
+            f"zone '{zone}' does not exist at DevNomads; register or transfer "
+            "the domain first (dncli dns zones list shows your zones)"
+        )
+    err_console.print(f"fetching {zone} from {source.name}")
+    records = source.get_records(zone)
+    data = client.request("GET", f"/services/dns/zones/{zone_id(zone)}")
+    rrsets = data.get("rrsets", []) if isinstance(data, dict) else []
+    changes, patch = diff_rrsets(
+        current_rrsets(rrsets, zone), desired_rrsets(records, zone)
+    )
+    if not changes:
+        err_console.print(f"{zone} is already in sync with {source.name}")
+        return
+    render(
+        state,
+        changes,
+        columns=["action", "name", "type", "ttl", "content"],
+        title=f"Transfer {zone} from {source.name}",
+    )
+    if dry_run:
+        err_console.print(f"dry run: {len(changes)} change(s) not applied")
+        return
+    _confirm(f"Apply {len(changes)} change(s) to {zone}", yes)
+    client.request(
+        "PATCH", f"/services/dns/zones/{zone_id(zone)}", json_body={"rrsets": patch}
+    )
+    err_console.print(f"applied {len(changes)} change(s) to {zone}")
+
+
+# ---------------------------------------------------------------------------
+# dehydrated DNS-01 hook
+#
+# dehydrated invokes its HOOK as a single executable with the event name as
+# the first argument, e.g. `HOOK deploy_challenge <domain> <token> <value>`.
+# Only deploy_challenge/clean_challenge plant or remove the validation TXT
+# record; every other event (deploy_cert, startup_hook, ...) is a no-op so
+# dehydrated can point all events at one program.
+
+HOOK_USAGE = (
+    "usage: dncli-dns-hook deploy_challenge|clean_challenge "
+    "<domain> <token_filename> <token_value>"
+)
+
+
+def _hook_dispatch(dns: Dns, operation: str, args: list[str]) -> int:
+    """Run one dehydrated hook event. ``args`` are the event arguments after
+    the operation name. Returns the process exit code."""
+
+    op = operation.lower()
+    if op not in ("deploy_challenge", "clean_challenge"):
+        return 0  # no-op for every other dehydrated event
+    if len(args) < 3:
+        err_console.print(HOOK_USAGE)
+        return 2
+    # args: <domain> <token_filename> <token_value>; the filename is unused
+    domain, token_value = args[0], args[2]
+    record = challenge_name(domain)
+    try:
+        if op == "deploy_challenge":
+            dns.set_txt(record, token_value)
+        else:
+            dns.unset_txt(record, token_value)
+    except (AuthError, ApiError) as exc:
+        err_console.print(f"[red]error:[/] {_error_message(exc.status, exc.detail)}")
+        return 1
+    except DevNomadsError as exc:
+        err_console.print(f"[red]error:[/] {exc}")
+        return 1
+    return 0
+
+
+def hook_main(argv: list[str] | None = None) -> int:
+    """Entry point for the ``dncli-dns-hook`` console script.
+
+    Parses ``sys.argv`` directly (argv[1] is the dehydrated event) so
+    dehydrated can exec it as a single binary.
+    """
+
+    argv = list(sys.argv if argv is None else argv)
+    if len(argv) < 2:
+        err_console.print(HOOK_USAGE)
+        return 2
+    operation = argv[1]
+    if operation.lower() in ("--help", "-h", "help"):
+        err_console.print(HOOK_USAGE)
+        return 0
+    # Resolve credentials only for events that actually touch the API, so
+    # dehydrated's many no-op events (deploy_cert, startup_hook, ...) never
+    # fail just because no key is configured for this hook environment.
+    if operation.lower() not in ("deploy_challenge", "clean_challenge"):
+        return 0
+    try:
+        client = ApiClient.from_environment()
+    except DevNomadsError as exc:
+        err_console.print(f"[red]error:[/] {exc}")
+        return 1
+    try:
+        return _hook_dispatch(Dns(client), operation, argv[2:])
+    finally:
+        client.close()
+
+
+@dns_app.command(
+    "hook",
+    context_settings={"allow_extra_args": True, "ignore_unknown_options": True},
+)
+def dns_hook(
+    ctx: typer.Context,
+    operation: Annotated[
+        str,
+        typer.Argument(
+            help="dehydrated event, e.g. deploy_challenge or clean_challenge."
+        ),
+    ],
+    args: Annotated[
+        list[str] | None,
+        typer.Argument(
+            help="Event arguments: <domain> <token_filename> <token_value>."
+        ),
+    ] = None,
+) -> None:
+    """dehydrated DNS-01 hook (deploy_challenge / clean_challenge).
+
+    For dehydrated, prefer the dedicated `dncli-dns-hook` binary, which it
+    can exec directly. This subcommand runs the same logic and honours the
+    global --profile / --api-key options.
+    """
+
+    state = state_from(ctx)
+    dns = Dns(get_client(state).api)
+    code = _hook_dispatch(dns, operation, list(args or []))
+    if code != 0:
+        raise typer.Exit(code=code)
+
+
+# ---------------------------------------------------------------------------
+# Certificate issuance (`dncli cert ...`), behind the `cert` extra.
+
+cert_app = typer.Typer(
+    cls=PrefixGroup, help="Issue and renew TLS certificates.", no_args_is_help=True
+)
+app.add_typer(cert_app, name="cert")
+
+LE_STAGING_DIRECTORY = "https://acme-staging-v02.api.letsencrypt.org/directory"
+CERT_RENEW_WINDOW_DAYS = 30
+
+
+def _load_acme() -> Any:
+    """Import devnomads.acme lazily, with a clean message if the extra is
+    missing."""
+
+    try:
+        import devnomads.acme as acme
+    except ImportError as exc:
+        raise CliError(
+            "certificate issuance needs the 'cert' extra; install it with: "
+            'pip install "devnomads-cli[cert]" '
+            '(or: uv tool install "devnomads-cli[cert]")'
+        ) from exc
+    return acme
+
+
+def _cert_out_dir(out: Path | None, domain: str) -> Path:
+    return out if out is not None else config_dir() / "certs" / domain
+
+
+def _account_key_path() -> Path:
+    return config_dir() / "acme" / "account.pem"
+
+
+def _write_cert_files(
+    out_dir: Path,
+    *,
+    privkey: str,
+    cert: str,
+    fullchain: str,
+    chain: str,
+) -> None:
+    out_dir.mkdir(parents=True, exist_ok=True)
+    _write_private(out_dir / "privkey.pem", privkey)
+    for name, content in (
+        ("cert.pem", cert),
+        ("fullchain.pem", fullchain),
+        ("chain.pem", chain),
+    ):
+        (out_dir / name).write_text(content)
+
+
+def _issue_certificate(
+    state: AppState,
+    domain: str,
+    *,
+    sans: list[str],
+    use_http01: bool,
+    webroot: str | None,
+    standalone: bool,
+    email: str | None,
+    key_type: str,
+    staging: bool,
+    out_dir: Path,
+) -> None:
+    """Obtain a certificate for ``domain`` and write it to ``out_dir``."""
+
+    acme = _load_acme()
+
+    directory_url = LE_STAGING_DIRECTORY if staging else acme.DEFAULT_DIRECTORY_URL
+    client = acme.AcmeClient(
+        str(_account_key_path()),
+        directory_url=directory_url,
+        contact_email=email,
+    )
+    try:
+        domain_key = acme.generate_key(key_type)
+    except acme.AcmeError as exc:
+        raise CliError(str(exc)) from exc
+
+    dns_provider = None
+    http01_solver = None
+    if use_http01:
+        if webroot:
+            http01_solver = acme.WebrootSolver(webroot)
+        else:
+            http01_solver = acme.StandaloneSolver()
+        challenge = "http-01"
+    else:
+        dns_provider = acme.DevNomadsDnsProvider(Dns(get_client(state).api))
+        challenge = "dns-01"
+
+    err_console.print(
+        f"issuing {challenge} certificate for {domain}"
+        + (f" (+{len(sans)} SAN(s))" if sans else "")
+        + (" [staging]" if staging else "")
+    )
+    try:
+        with http01_solver or nullcontext() as solver:
+            leaf, fullchain, chain, key_pem = client.obtain_certificate(
+                domain,
+                challenge,
+                domain_key,
+                sans=sans or None,
+                dns_provider=dns_provider,
+                http01_solver=solver if use_http01 else None,
+            )
+    except acme.AcmeError as exc:
+        raise CliError(str(exc)) from exc
+    except DevNomadsError as exc:
+        raise CliError(str(exc)) from exc
+
+    _write_cert_files(
+        out_dir,
+        privkey=key_pem.decode() if isinstance(key_pem, bytes) else key_pem,
+        cert=leaf,
+        fullchain=fullchain,
+        chain=chain,
+    )
+    err_console.print(f"wrote certificate to {out_dir}")
+
+
+@cert_app.command("issue")
+def cert_issue(
+    ctx: typer.Context,
+    domain: Annotated[str, typer.Argument(help="Primary domain (certificate CN).")],
+    san: Annotated[
+        list[str] | None,
+        typer.Option("--san", "-d", help="Additional SAN; repeat for more."),
+    ] = None,
+    dns_01: Annotated[
+        bool, typer.Option("--dns-01", help="Use the DNS-01 challenge (default).")
+    ] = False,
+    http_01: Annotated[
+        bool, typer.Option("--http-01", help="Use the HTTP-01 challenge.")
+    ] = False,
+    webroot: Annotated[
+        str | None,
+        typer.Option("--webroot", help="HTTP-01 webroot directory to write into."),
+    ] = None,
+    standalone: Annotated[
+        bool,
+        typer.Option("--standalone", help="HTTP-01 via a built-in server on :80."),
+    ] = False,
+    email: Annotated[
+        str | None, typer.Option("--email", help="ACME account contact email.")
+    ] = None,
+    key_type: Annotated[
+        str, typer.Option("--key-type", help="Certificate key type.")
+    ] = "ec256",
+    staging: Annotated[
+        bool, typer.Option("--staging", help="Use the Let's Encrypt staging CA.")
+    ] = False,
+    out: Annotated[
+        Path | None,
+        typer.Option(
+            "--out", help="Output directory (default <config>/certs/<domain>)."
+        ),
+    ] = None,
+) -> None:
+    """Issue a TLS certificate for a domain via ACME (Let's Encrypt)."""
+
+    state = state_from(ctx)
+    if dns_01 and http_01:
+        raise CliError("choose only one of --dns-01 / --http-01")
+    if webroot and standalone:
+        raise CliError("choose only one of --webroot / --standalone")
+    use_http01 = http_01 or bool(webroot) or standalone
+    if dns_01 and use_http01:
+        raise CliError("--dns-01 cannot be combined with HTTP-01 options")
+    _issue_certificate(
+        state,
+        domain,
+        sans=list(san or []),
+        use_http01=use_http01,
+        webroot=webroot,
+        standalone=standalone,
+        email=email,
+        key_type=key_type,
+        staging=staging,
+        out_dir=_cert_out_dir(out, domain),
+    )
+
+
+def _cert_expires_within(cert_path: Path, days: int) -> bool:
+    """True if the certificate at ``cert_path`` expires within ``days``
+    (or is missing/unreadable, so it gets re-issued)."""
+
+    from datetime import datetime, timedelta, timezone
+
+    from cryptography import x509
+
+    try:
+        cert = x509.load_pem_x509_certificate(cert_path.read_bytes())
+    except (OSError, ValueError):
+        return True
+    try:
+        not_after = cert.not_valid_after_utc
+    except AttributeError:  # cryptography < 42 fallback
+        not_after = cert.not_valid_after.replace(tzinfo=timezone.utc)
+    return not_after - datetime.now(timezone.utc) <= timedelta(days=days)
+
+
+@cert_app.command("renew")
+def cert_renew(
+    ctx: typer.Context,
+    domain: Annotated[
+        str | None,
+        typer.Argument(help="Domain to renew; omit to renew every issued cert."),
+    ] = None,
+    email: Annotated[
+        str | None, typer.Option("--email", help="ACME account contact email.")
+    ] = None,
+    key_type: Annotated[
+        str, typer.Option("--key-type", help="Certificate key type.")
+    ] = "ec256",
+    staging: Annotated[
+        bool, typer.Option("--staging", help="Use the Let's Encrypt staging CA.")
+    ] = False,
+) -> None:
+    """Re-issue certificates that expire within 30 days; skip the rest."""
+
+    state = state_from(ctx)
+    certs_root = config_dir() / "certs"
+    if domain:
+        domains = [domain]
+    else:
+        domains = sorted(p.name for p in certs_root.glob("*") if p.is_dir())
+    if not domains:
+        err_console.print("[dim]no certificates to renew[/]")
+        return
+
+    for name in domains:
+        out_dir = certs_root / name
+        cert_path = out_dir / "cert.pem"
+        if not _cert_expires_within(cert_path, CERT_RENEW_WINDOW_DAYS):
+            err_console.print(f"{name}: still valid, skipping")
+            continue
+        err_console.print(f"{name}: renewing")
+        _issue_certificate(
+            state,
+            name,
+            sans=[],
+            use_http01=False,
+            webroot=None,
+            standalone=False,
+            email=email,
+            key_type=key_type,
+            staging=staging,
+            out_dir=out_dir,
+        )
+
+
+# ---------------------------------------------------------------------------
+# Generated commands. tools/generate.py renders one thin command per
+# OpenAPI operation between the markers below, from openapi.json plus
+# the curation overlay in overlay.json. Do not edit the region by hand.
+
+_SORT_OPT = typer.Option(
+    None,
+    "--sort",
+    help="Sort by field; prefix with - for descending (e.g. --sort -ttl).",
+)
+_YES_OPT = typer.Option(False, "--yes", "-y", help="Do not ask for confirmation.")
+_OUTPUT_OPT = typer.Option(
+    None, "--output", "-o", help="Output format (table or json)."
+)
+
+
+def _generated_call(
+    ctx: typer.Context,
+    method: str,
+    path_template: str,
+    path_params: dict[str, Any],
+    *,
+    body: dict[str, Any] | None = None,
+    sort: str | None = None,
+    columns: list[str] | None = None,
+    confirm: str | None = None,
+    yes: bool = False,
+    output: OutputFormat | None = None,
+) -> None:
+    """Shared runtime for generated commands: build the path, confirm if
+    needed, call the API, render the result."""
+
+    state = state_from(ctx, output)
+    if confirm:
+        detail = ", ".join(f"{key}={value}" for key, value in path_params.items())
+        _confirm(f"{confirm} ({detail})?" if detail else f"{confirm}?", yes)
+    quoted = {
+        key: urllib.parse.quote(str(value), safe="")
+        for key, value in path_params.items()
+    }
+    path = path_template.format(**quoted)
+    payload = {key: value for key, value in (body or {}).items() if value is not None}
+    data = get_client(state).request(method, path, json_body=payload or None)
+    if data is None:
+        err_console.print("ok")
+        return
+    if isinstance(data, list):
+        data = sort_rows(data, sort)
+    render(state, data, columns=columns, title=path)
+
+
+# --- BEGIN GENERATED COMMANDS (tools/generate.py; do not edit by hand) ---
+
+gen_apps = typer.Typer(cls=PrefixGroup, help="Manage apps.", no_args_is_help=True)
+app.add_typer(gen_apps, name="apps")
+gen_buckets = typer.Typer(cls=PrefixGroup, help="Manage buckets.", no_args_is_help=True)
+app.add_typer(gen_buckets, name="buckets")
+gen_containers = typer.Typer(
+    cls=PrefixGroup, help="Manage containers.", no_args_is_help=True
+)
+app.add_typer(gen_containers, name="containers")
+gen_databases = typer.Typer(
+    cls=PrefixGroup, help="Manage databases.", no_args_is_help=True
+)
+app.add_typer(gen_databases, name="databases")
+gen_domains = typer.Typer(cls=PrefixGroup, help="Manage domains.", no_args_is_help=True)
+app.add_typer(gen_domains, name="domains")
+gen_emails = typer.Typer(cls=PrefixGroup, help="Manage emails.", no_args_is_help=True)
+app.add_typer(gen_emails, name="emails")
+gen_forwards = typer.Typer(
+    cls=PrefixGroup, help="Manage forwards.", no_args_is_help=True
+)
+app.add_typer(gen_forwards, name="forwards")
+gen_handles = typer.Typer(cls=PrefixGroup, help="Manage handles.", no_args_is_help=True)
+app.add_typer(gen_handles, name="handles")
+gen_proxies = typer.Typer(cls=PrefixGroup, help="Manage proxies.", no_args_is_help=True)
+app.add_typer(gen_proxies, name="proxies")
+gen_searches = typer.Typer(
+    cls=PrefixGroup, help="Manage searches.", no_args_is_help=True
+)
+app.add_typer(gen_searches, name="searches")
+gen_servers = typer.Typer(cls=PrefixGroup, help="Manage servers.", no_args_is_help=True)
+app.add_typer(gen_servers, name="servers")
+gen_sites = typer.Typer(cls=PrefixGroup, help="Manage sites.", no_args_is_help=True)
+app.add_typer(gen_sites, name="sites")
+gen_spams = typer.Typer(cls=PrefixGroup, help="Manage spams.", no_args_is_help=True)
+app.add_typer(gen_spams, name="spams")
+gen_containers_instances = typer.Typer(
+    cls=PrefixGroup, help="Manage containers instances.", no_args_is_help=True
+)
+gen_containers.add_typer(gen_containers_instances, name="instances")
+gen_databases_clusters = typer.Typer(
+    cls=PrefixGroup, help="Manage databases clusters.", no_args_is_help=True
+)
+gen_databases.add_typer(gen_databases_clusters, name="clusters")
+gen_databases_permissions = typer.Typer(
+    cls=PrefixGroup, help="Manage databases permissions.", no_args_is_help=True
+)
+gen_databases.add_typer(gen_databases_permissions, name="permissions")
+gen_databases_users = typer.Typer(
+    cls=PrefixGroup, help="Manage databases users.", no_args_is_help=True
+)
+gen_databases.add_typer(gen_databases_users, name="users")
+gen_emails_aliases = typer.Typer(
+    cls=PrefixGroup, help="Manage emails aliases.", no_args_is_help=True
+)
+gen_emails.add_typer(gen_emails_aliases, name="aliases")
+gen_emails_dkim = typer.Typer(
+    cls=PrefixGroup, help="Manage emails dkim.", no_args_is_help=True
+)
+gen_emails.add_typer(gen_emails_dkim, name="dkim")
+gen_emails_forwardings = typer.Typer(
+    cls=PrefixGroup, help="Manage emails forwardings.", no_args_is_help=True
+)
+gen_emails.add_typer(gen_emails_forwardings, name="forwardings")
+gen_emails_mailboxes = typer.Typer(
+    cls=PrefixGroup, help="Manage emails mailboxes.", no_args_is_help=True
+)
+gen_emails.add_typer(gen_emails_mailboxes, name="mailboxes")
+gen_emails_records = typer.Typer(
+    cls=PrefixGroup, help="Manage emails records.", no_args_is_help=True
+)
+gen_emails.add_typer(gen_emails_records, name="records")
+gen_emails_transactional = typer.Typer(
+    cls=PrefixGroup, help="Manage emails transactional.", no_args_is_help=True
+)
+gen_emails.add_typer(gen_emails_transactional, name="transactional")
+gen_spams_clusters = typer.Typer(
+    cls=PrefixGroup, help="Manage spams clusters.", no_args_is_help=True
+)
+gen_spams.add_typer(gen_spams_clusters, name="clusters")
+gen_spams_domain = typer.Typer(
+    cls=PrefixGroup, help="Manage spams domain.", no_args_is_help=True
+)
+gen_spams.add_typer(gen_spams_domain, name="domain")
+gen_spams_transports = typer.Typer(
+    cls=PrefixGroup, help="Manage spams transports.", no_args_is_help=True
+)
+gen_spams.add_typer(gen_spams_transports, name="transports")
+gen_containers_instances_volumes = typer.Typer(
+    cls=PrefixGroup, help="Manage containers instances volumes.", no_args_is_help=True
+)
+gen_containers_instances.add_typer(gen_containers_instances_volumes, name="volumes")
+gen_databases_clusters_users = typer.Typer(
+    cls=PrefixGroup, help="Manage databases clusters users.", no_args_is_help=True
+)
+gen_databases_clusters.add_typer(gen_databases_clusters_users, name="users")
+gen_emails_transactional_aliases = typer.Typer(
+    cls=PrefixGroup, help="Manage emails transactional aliases.", no_args_is_help=True
+)
+gen_emails_transactional.add_typer(gen_emails_transactional_aliases, name="aliases")
+gen_emails_transactional_keys = typer.Typer(
+    cls=PrefixGroup, help="Manage emails transactional keys.", no_args_is_help=True
+)
+gen_emails_transactional.add_typer(gen_emails_transactional_keys, name="keys")
+gen_emails_transactional_users = typer.Typer(
+    cls=PrefixGroup, help="Manage emails transactional users.", no_args_is_help=True
+)
+gen_emails_transactional.add_typer(gen_emails_transactional_users, name="users")
+gen_spams_domain_dkim = typer.Typer(
+    cls=PrefixGroup, help="Manage spams domain dkim.", no_args_is_help=True
+)
+gen_spams_domain.add_typer(gen_spams_domain_dkim, name="dkim")
+
+
+@gen_handles.command("create")
+def gen_handles_create(
+    ctx: typer.Context,
+    client_id: int | None = typer.Option(None),
+    firstname: str | None = typer.Option(None),
+    prefix: str | None = typer.Option(None),
+    lastname: str | None = typer.Option(None),
+    company: str | None = typer.Option(None),
+    vat_id: str | None = typer.Option(None),
+    email: str | None = typer.Option(None),
+    phone_country_code: str | None = typer.Option(None),
+    phone_area_code: str | None = typer.Option(None),
+    phone_number: str | None = typer.Option(None),
+    street: str | None = typer.Option(None),
+    number: str | None = typer.Option(None),
+    zipcode: str | None = typer.Option(None),
+    city: str | None = typer.Option(None),
+    region: str | None = typer.Option(None),
+    country: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create a contact handle."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/handles",
+        {},
+        body={
+            "client_id": client_id,
+            "firstname": firstname,
+            "prefix": prefix,
+            "lastname": lastname,
+            "company": company,
+            "vat_id": vat_id,
+            "email": email,
+            "phone_country_code": phone_country_code,
+            "phone_area_code": phone_area_code,
+            "phone_number": phone_number,
+            "street": street,
+            "number": number,
+            "zipcode": zipcode,
+            "city": city,
+            "region": region,
+            "country": country,
+        },
+        output=output,
+    )
+
+
+@gen_handles.command("list")
+def gen_handles_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List your contact handles."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/handles",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_handles.command("show")
+def gen_handles_show(
+    ctx: typer.Context,
+    handle_id: int = typer.Argument(..., metavar="HANDLE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show one contact handle."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/handles/{handleId}",
+        {"handleId": handle_id},
+        output=output,
+    )
+
+
+@gen_apps.command("list")
+def gen_services_apps_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List apps."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/apps",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_apps.command("show")
+def gen_services_apps_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show apps details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/apps/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_apps.command("state")
+def gen_services_apps_state(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    state: str = typer.Argument(..., metavar="STATE"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Change the state of an app service."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/apps/{serviceId}/state/{state}",
+        {"serviceId": service_id, "state": state},
+        confirm="State apps",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_buckets.command("list")
+def gen_services_buckets_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List buckets."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/buckets",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_buckets.command("show")
+def gen_services_buckets_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show buckets details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/buckets/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_containers.command("deploy")
+def gen_services_containers_deploy(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Deploy a container service."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/deploy",
+        {"serviceId": service_id},
+        confirm="Deploy containers",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_containers.command("list")
+def gen_services_containers_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List containers."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_containers_instances.command("deploy")
+def gen_services_containers_instances_deploy(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Deploy a container instance."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances/{instanceId}/deploy",
+        {"serviceId": service_id, "instanceId": instance_id},
+        confirm="Deploy containers instances",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_containers_instances.command("list")
+def gen_services_containers_instances_index(
+    ctx: typer.Context,
+    service_id: str = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List containers instances."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_containers_instances.command("logs")
+def gen_services_containers_instances_logs(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show the logs of a container instance."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances/{instanceId}/logs",
+        {"serviceId": service_id, "instanceId": instance_id},
+        output=output,
+    )
+
+
+@gen_containers_instances.command("show")
+def gen_services_containers_instances_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show containers instances details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances/{instanceId}",
+        {"serviceId": service_id, "instanceId": instance_id},
+        output=output,
+    )
+
+
+@gen_containers_instances.command("state")
+def gen_services_containers_instances_state(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    state: str = typer.Argument(..., metavar="STATE"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Change the state of a container instance."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances/{instanceId}/state/{state}",
+        {"serviceId": service_id, "instanceId": instance_id, "state": state},
+        confirm="State containers instances",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_containers_instances.command("update")
+def gen_services_containers_instances_update(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    image: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update containers instances."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/containers/{serviceId}/instances/{instanceId}",
+        {"serviceId": service_id, "instanceId": instance_id},
+        body={"image": image},
+        output=output,
+    )
+
+
+@gen_containers_instances_volumes.command("list")
+def gen_services_containers_instances_volumes_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List containers instances volumes."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances/{instanceId}/volumes",
+        {"serviceId": service_id, "instanceId": instance_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_containers_instances_volumes.command("show")
+def gen_services_containers_instances_volumes_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    volume_id: int = typer.Argument(..., metavar="VOLUME_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show containers instances volumes details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}/instances/{instanceId}/volumes/{volumeId}",
+        {"serviceId": service_id, "instanceId": instance_id, "volumeId": volume_id},
+        output=output,
+    )
+
+
+@gen_containers_instances_volumes.command("update")
+def gen_services_containers_instances_volumes_update(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    instance_id: int = typer.Argument(..., metavar="INSTANCE_ID"),
+    volume_id: int = typer.Argument(..., metavar="VOLUME_ID"),
+    path: str | None = typer.Option(None),
+    uid: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update containers instances volumes."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/containers/{serviceId}/instances/{instanceId}/volumes/{volumeId}",
+        {"serviceId": service_id, "instanceId": instance_id, "volumeId": volume_id},
+        body={"path": path, "uid": uid},
+        output=output,
+    )
+
+
+@gen_containers.command("show")
+def gen_services_containers_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show containers details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/containers/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_containers.command("update")
+def gen_services_containers_update(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    registry_url: str | None = typer.Option(None),
+    description: str | None = typer.Option(None),
+    port: int | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update containers."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/container/{serviceId}",
+        {"serviceId": service_id},
+        body={"registry_url": registry_url, "description": description, "port": port},
+        output=output,
+    )
+
+
+@gen_databases_clusters.command("list")
+def gen_services_databases_clusters_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List databases clusters."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/databases/clusters",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_databases_clusters.command("show")
+def gen_services_databases_clusters_show(
+    ctx: typer.Context,
+    cluster_id: int = typer.Argument(..., metavar="CLUSTER_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show databases clusters details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/databases/clusters/{clusterId}",
+        {"clusterId": cluster_id},
+        output=output,
+    )
+
+
+@gen_databases_clusters_users.command("list")
+def gen_services_databases_clusters_users_index(
+    ctx: typer.Context,
+    cluster_id: int = typer.Argument(..., metavar="CLUSTER_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List databases clusters users."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/databases/clusters/{clusterId}/users",
+        {"clusterId": cluster_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_databases_clusters_users.command("show")
+def gen_services_databases_clusters_users_show(
+    ctx: typer.Context,
+    cluster_id: int = typer.Argument(..., metavar="CLUSTER_ID"),
+    user_id: int = typer.Argument(..., metavar="USER_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show databases clusters users details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/databases/clusters/{clusterId}/users/{userId}",
+        {"clusterId": cluster_id, "userId": user_id},
+        output=output,
+    )
+
+
+@gen_databases.command("list")
+def gen_services_databases_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List databases."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/databases",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_databases_permissions.command("create")
+def gen_services_databases_permissions_create(
+    ctx: typer.Context,
+    service_id: str = typer.Argument(..., metavar="SERVICE_ID"),
+    user_id: str | None = typer.Option(None),
+    permissions: list[str] | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create databases permissions."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/databases/{serviceId}/permissions",
+        {"serviceId": service_id},
+        body={"user_id": user_id, "permissions": permissions},
+        output=output,
+    )
+
+
+@gen_databases.command("show")
+def gen_services_databases_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show databases details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/databases/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_databases.command("create")
+def gen_services_databases_store(
+    ctx: typer.Context,
+    name: str | None = typer.Option(None),
+    client_id: int | None = typer.Option(None),
+    cluster_id: int | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create databases."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/databases",
+        {},
+        body={"name": name, "client_id": client_id, "cluster_id": cluster_id},
+        output=output,
+    )
+
+
+@gen_databases_users.command("create")
+def gen_services_databases_users_store(
+    ctx: typer.Context,
+    cluster_id: str = typer.Argument(..., metavar="CLUSTER_ID"),
+    username: str | None = typer.Option(None),
+    password: str | None = typer.Option(None),
+    client_id: int | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create databases users."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/databases/clusters/{clusterId}/users",
+        {"clusterId": cluster_id},
+        body={"username": username, "password": password, "client_id": client_id},
+        output=output,
+    )
+
+
+@gen_databases_users.command("update")
+def gen_services_databases_users_update(
+    ctx: typer.Context,
+    cluster_id: str = typer.Argument(..., metavar="CLUSTER_ID"),
+    user_id: str = typer.Argument(..., metavar="USER_ID"),
+    password: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update databases users."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/databases/clusters/{clusterId}/users/{userId}",
+        {"clusterId": cluster_id, "userId": user_id},
+        body={"password": password},
+        output=output,
+    )
+
+
+@gen_domains.command("create")
+def gen_services_domains_create(
+    ctx: typer.Context,
+    nameserver_group: str | None = typer.Option(None),
+    domain: str | None = typer.Option(None),
+    client_id: int | None = typer.Option(None),
+    type: str | None = typer.Option(None),
+    token: str | None = typer.Option(None),
+    handle_id_owner: int | None = typer.Option(None),
+    handle_id_administrative: int | None = typer.Option(None),
+    handle_id_technical: int | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create domains."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/domains",
+        {},
+        body={
+            "nameserver_group": nameserver_group,
+            "domain": domain,
+            "client_id": client_id,
+            "type": type,
+            "token": token,
+            "handle_id_owner": handle_id_owner,
+            "handle_id_administrative": handle_id_administrative,
+            "handle_id_technical": handle_id_technical,
+        },
+        output=output,
+    )
+
+
+@gen_domains.command("list")
+def gen_services_domains_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List domains."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/domains",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_domains.command("show")
+def gen_services_domains_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show domains details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/domains/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_emails_aliases.command("create")
+def gen_services_emails_aliases_create(
+    ctx: typer.Context,
+    service_id: str = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str | None = typer.Option(None),
+    alias: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails aliases."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails/{serviceId}/aliases",
+        {"serviceId": service_id},
+        body={"emailaddress": emailaddress, "alias": alias},
+        output=output,
+    )
+
+
+@gen_emails_aliases.command("delete")
+def gen_services_emails_aliases_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    alias_id: int = typer.Argument(..., metavar="ALIAS_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails aliases."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}/aliases/{aliasId}",
+        {"serviceId": service_id, "aliasId": alias_id},
+        confirm="Delete emails aliases",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_aliases.command("list")
+def gen_services_emails_aliases_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails aliases."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/aliases",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_aliases.command("show")
+def gen_services_emails_aliases_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    alias_id: int = typer.Argument(..., metavar="ALIAS_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show emails aliases details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/aliases/{aliasId}",
+        {"serviceId": service_id, "aliasId": alias_id},
+        output=output,
+    )
+
+
+@gen_emails.command("create")
+def gen_services_emails_create(
+    ctx: typer.Context,
+    domain: str | None = typer.Option(None),
+    client_id: int | None = typer.Option(None),
+    type: str | None = typer.Option(None),
+    return_path_domain: str | None = typer.Option(None),
+    relay_hosts: list[str] | None = typer.Option(None),
+    delivery_rate: int | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails",
+        {},
+        body={
+            "domain": domain,
+            "client_id": client_id,
+            "type": type,
+            "return_path_domain": return_path_domain,
+            "relay_hosts": relay_hosts,
+            "delivery_rate": delivery_rate,
+        },
+        output=output,
+    )
+
+
+@gen_emails.command("delete")
+def gen_services_emails_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}",
+        {"serviceId": service_id},
+        confirm="Delete emails",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_dkim.command("show")
+def gen_services_emails_dkim_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show the DKIM configuration of an email service."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/dkim",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_emails_forwardings.command("create")
+def gen_services_emails_forwardings_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str | None = typer.Option(None),
+    target: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails forwardings."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails/{serviceId}/forwardings",
+        {"serviceId": service_id},
+        body={"emailaddress": emailaddress, "target": target},
+        output=output,
+    )
+
+
+@gen_emails_forwardings.command("delete")
+def gen_services_emails_forwardings_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    forwarding_id: int = typer.Argument(..., metavar="FORWARDING_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails forwardings."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}/forwardings/{forwardingId}",
+        {"serviceId": service_id, "forwardingId": forwarding_id},
+        confirm="Delete emails forwardings",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_forwardings.command("list")
+def gen_services_emails_forwardings_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails forwardings."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/forwardings",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_forwardings.command("show")
+def gen_services_emails_forwardings_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    forwarding_id: int = typer.Argument(..., metavar="FORWARDING_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show emails forwardings details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/forwardings/{forwardingId}",
+        {"serviceId": service_id, "forwardingId": forwarding_id},
+        output=output,
+    )
+
+
+@gen_emails.command("list")
+def gen_services_emails_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_mailboxes.command("create")
+def gen_services_emails_mailboxes_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str | None = typer.Option(None),
+    password: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails mailboxes."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails/{serviceId}/mailboxes",
+        {"serviceId": service_id},
+        body={"emailaddress": emailaddress, "password": password},
+        output=output,
+    )
+
+
+@gen_emails_mailboxes.command("delete")
+def gen_services_emails_mailboxes_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str = typer.Argument(..., metavar="EMAILADDRESS"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails mailboxes."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}/mailboxes/{emailaddress}",
+        {"serviceId": service_id, "emailaddress": emailaddress},
+        confirm="Delete emails mailboxes",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_mailboxes.command("list")
+def gen_services_emails_mailboxes_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails mailboxes."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/mailboxes",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_mailboxes.command("show")
+def gen_services_emails_mailboxes_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str = typer.Argument(..., metavar="EMAILADDRESS"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show emails mailboxes details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/mailboxes/{emailaddress}",
+        {"serviceId": service_id, "emailaddress": emailaddress},
+        output=output,
+    )
+
+
+@gen_emails_mailboxes.command("update")
+def gen_services_emails_mailboxes_update(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str = typer.Argument(..., metavar="EMAILADDRESS"),
+    password: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update emails mailboxes."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/emails/{serviceId}/mailboxes/{emailaddress}",
+        {"serviceId": service_id, "emailaddress": emailaddress},
+        body={"password": password},
+        output=output,
+    )
+
+
+@gen_emails_records.command("list")
+def gen_services_emails_records_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List the DNS records an email service needs."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/records",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails.command("show")
+def gen_services_emails_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show emails details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_emails_transactional_aliases.command("create")
+def gen_services_emails_transactional_aliases_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails transactional aliases."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails/{serviceId}/transactional/aliases",
+        {"serviceId": service_id},
+        body={"domain": domain},
+        output=output,
+    )
+
+
+@gen_emails_transactional_aliases.command("delete")
+def gen_services_emails_transactional_aliases_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    alias_id: int = typer.Argument(..., metavar="ALIAS_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails transactional aliases."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}/transactional/aliases/{aliasId}",
+        {"serviceId": service_id, "aliasId": alias_id},
+        confirm="Delete emails transactional aliases",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_transactional_aliases.command("list")
+def gen_services_emails_transactional_aliases_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails transactional aliases."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/transactional/aliases",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_transactional_keys.command("create")
+def gen_services_emails_transactional_keys_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    name: str | None = typer.Option(None),
+    key: str | None = typer.Option(None),
+    active: bool | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails transactional keys."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails/{serviceId}/transactional/keys",
+        {"serviceId": service_id},
+        body={"name": name, "key": key, "active": active},
+        output=output,
+    )
+
+
+@gen_emails_transactional_keys.command("delete")
+def gen_services_emails_transactional_keys_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    key_id: int = typer.Argument(..., metavar="KEY_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails transactional keys."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}/transactional/keys/{keyId}",
+        {"serviceId": service_id, "keyId": key_id},
+        confirm="Delete emails transactional keys",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_transactional_keys.command("list")
+def gen_services_emails_transactional_keys_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails transactional keys."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/transactional/keys",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_transactional_keys.command("show")
+def gen_services_emails_transactional_keys_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    key_id: int = typer.Argument(..., metavar="KEY_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show emails transactional keys details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/transactional/keys/{keyId}",
+        {"serviceId": service_id, "keyId": key_id},
+        output=output,
+    )
+
+
+@gen_emails_transactional_keys.command("update")
+def gen_services_emails_transactional_keys_update(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    key_id: int = typer.Argument(..., metavar="KEY_ID"),
+    name: str | None = typer.Option(None),
+    key: str | None = typer.Option(None),
+    active: bool | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update emails transactional keys."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/emails/{serviceId}/transactional/keys/{keyId}",
+        {"serviceId": service_id, "keyId": key_id},
+        body={"name": name, "key": key, "active": active},
+        output=output,
+    )
+
+
+@gen_emails_transactional_users.command("create")
+def gen_services_emails_transactional_users_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    emailaddress: str | None = typer.Option(None),
+    password: str | None = typer.Option(None),
+    delivery_mode: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create emails transactional users."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/emails/{serviceId}/transactional/users",
+        {"serviceId": service_id},
+        body={
+            "emailaddress": emailaddress,
+            "password": password,
+            "delivery_mode": delivery_mode,
+        },
+        output=output,
+    )
+
+
+@gen_emails_transactional_users.command("delete")
+def gen_services_emails_transactional_users_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    user_id: int = typer.Argument(..., metavar="USER_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete emails transactional users."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/emails/{serviceId}/transactional/users/{userId}",
+        {"serviceId": service_id, "userId": user_id},
+        confirm="Delete emails transactional users",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_emails_transactional_users.command("list")
+def gen_services_emails_transactional_users_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List emails transactional users."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/transactional/users",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_emails_transactional_users.command("show")
+def gen_services_emails_transactional_users_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    user_id: int = typer.Argument(..., metavar="USER_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show emails transactional users details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/emails/{serviceId}/transactional/users/{userId}",
+        {"serviceId": service_id, "userId": user_id},
+        output=output,
+    )
+
+
+@gen_emails_transactional_users.command("update")
+def gen_services_emails_transactional_users_update(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    user_id: int = typer.Argument(..., metavar="USER_ID"),
+    password: str | None = typer.Option(None),
+    delivery_mode: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Update emails transactional users."""
+
+    _generated_call(
+        ctx,
+        "PUT",
+        "/services/emails/{serviceId}/transactional/users/{userId}",
+        {"serviceId": service_id, "userId": user_id},
+        body={"password": password, "delivery_mode": delivery_mode},
+        output=output,
+    )
+
+
+@gen_forwards.command("list")
+def gen_services_forwards_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List forwards."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/forwards",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_forwards.command("show")
+def gen_services_forwards_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show forwards details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/forwards/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_proxies.command("down")
+def gen_services_proxies_down(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Bring a proxy down."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/proxies/{serviceId}/down",
+        {"serviceId": service_id},
+        confirm="Down proxies",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_proxies.command("list")
+def gen_services_proxies_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List proxies."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/proxies",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_proxies.command("show")
+def gen_services_proxies_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show proxies details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/proxies/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_proxies.command("up")
+def gen_services_proxies_up(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Bring a proxy up."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/proxies/{serviceId}/up",
+        {"serviceId": service_id},
+        confirm="Up proxies",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_searches.command("list")
+def gen_services_searches_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List searches."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/searches",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_searches.command("show")
+def gen_services_searches_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show searches details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/searches/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_servers.command("list")
+def gen_services_servers_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List servers."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/servers",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_servers.command("show")
+def gen_services_servers_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show servers details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/servers/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_servers.command("state")
+def gen_services_servers_state(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    state: str = typer.Argument(..., metavar="STATE"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Change the state of a server."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/servers/{serviceId}/state/{state}",
+        {"serviceId": service_id, "state": state},
+        confirm="State servers",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_sites.command("list")
+def gen_services_sites_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List sites."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/sites",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_sites.command("show")
+def gen_services_sites_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show sites details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/sites/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_spams_clusters.command("list")
+def gen_services_spams_clusters_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List spams clusters."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/clusters",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_spams_clusters.command("show")
+def gen_services_spams_clusters_show(
+    ctx: typer.Context,
+    cluster_id: int = typer.Argument(..., metavar="CLUSTER_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show spams clusters details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/clusters/{clusterId}",
+        {"clusterId": cluster_id},
+        output=output,
+    )
+
+
+@gen_spams_domain.command("create")
+def gen_services_spams_domain_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create spams domain."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/spams/{serviceId}/domains",
+        {"serviceId": service_id},
+        body={"domain": domain},
+        output=output,
+    )
+
+
+@gen_spams_domain.command("delete")
+def gen_services_spams_domain_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str = typer.Argument(..., metavar="DOMAIN"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete spams domain."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/spams/{serviceId}/domains/{domain}",
+        {"serviceId": service_id, "domain": domain},
+        confirm="Delete spams domain",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_spams_domain_dkim.command("disable")
+def gen_services_spams_domain_dkim_disable(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str = typer.Argument(..., metavar="DOMAIN"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Disable DKIM for a spam filter domain."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}/domains/{domain}/dkim/disable",
+        {"serviceId": service_id, "domain": domain},
+        confirm="Disable spams domain dkim",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_spams_domain_dkim.command("enable")
+def gen_services_spams_domain_dkim_enable(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str = typer.Argument(..., metavar="DOMAIN"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Enable DKIM for a spam filter domain."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}/domains/{domain}/dkim/enable",
+        {"serviceId": service_id, "domain": domain},
+        confirm="Enable spams domain dkim",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_spams_domain.command("list")
+def gen_services_spams_domain_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List spams domain."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}/domains",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_spams_domain.command("show")
+def gen_services_spams_domain_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str = typer.Argument(..., metavar="DOMAIN"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show spams domain details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}/domains/{domain}",
+        {"serviceId": service_id, "domain": domain},
+        output=output,
+    )
+
+
+@gen_spams.command("list")
+def gen_services_spams_index(
+    ctx: typer.Context,
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List spams."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams",
+        {},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_spams.command("show")
+def gen_services_spams_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show spams details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}",
+        {"serviceId": service_id},
+        output=output,
+    )
+
+
+@gen_spams_transports.command("create")
+def gen_services_spams_transports_create(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str | None = typer.Option(None),
+    host: str | None = typer.Option(None),
+    port: int | None = typer.Option(None),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Create spams transports."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/spams/{serviceId}/transports",
+        {"serviceId": service_id},
+        body={"domain": domain, "host": host, "port": port},
+        output=output,
+    )
+
+
+@gen_spams_transports.command("delete")
+def gen_services_spams_transports_delete(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str = typer.Argument(..., metavar="DOMAIN"),
+    yes: bool = _YES_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Delete spams transports."""
+
+    _generated_call(
+        ctx,
+        "DELETE",
+        "/services/spams/{serviceId}/transports/{domain}",
+        {"serviceId": service_id, "domain": domain},
+        confirm="Delete spams transports",
+        yes=yes,
+        output=output,
+    )
+
+
+@gen_spams_transports.command("list")
+def gen_services_spams_transports_index(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    sort: str | None = _SORT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """List spams transports."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}/transports",
+        {"serviceId": service_id},
+        sort=sort,
+        output=output,
+    )
+
+
+@gen_spams_transports.command("show")
+def gen_services_spams_transports_show(
+    ctx: typer.Context,
+    service_id: int = typer.Argument(..., metavar="SERVICE_ID"),
+    domain: str = typer.Argument(..., metavar="DOMAIN"),
+    output: OutputFormat | None = _OUTPUT_OPT,
+) -> None:
+    """Show spams transports details."""
+
+    _generated_call(
+        ctx,
+        "GET",
+        "/services/spams/{serviceId}/transports/{domain}",
+        {"serviceId": service_id, "domain": domain},
+        output=output,
+    )
+
+
+# --- END GENERATED COMMANDS ---
+
+
+def run() -> None:
+    app()
+
+
+if __name__ == "__main__":
+    run()